clearlinux/WALinuxAgent
2
0
Fork 0
mirror of https://github.com/clearlinux/WALinuxAgent.git synced 2026-09-07 06:11:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

Improve firewall handling and make GoalState retrieval more robust

Browse Source 
Signed-off-by: Brendan Dixon <brendandixon@me.com>
This commit is contained in:
Brendan Dixon
2017-08-22 16:11:50 -07:00
parent edfde01867
commit be77729cb8
4 changed files with 13 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
azurelinuxagent/common/osutil/default.py
+3 -5
View File
@@ -73,16 +73,14 @@ class DefaultOSUtil(object):
if dst_ip is None or uid is None:
raise Exception("Missing arguments to enable_firewall")
# If either firewall rule exists, make no changes
accept_rule = FIREWALL_ACCEPT.format("C", dst_ip, uid, FIREWALL_WAIT_IN_SECONDS)
# If the DROP rule exists, make no changes
drop_rule = FIREWALL_DROP.format("C", dst_ip, FIREWALL_WAIT_IN_SECONDS)
if shellutil.run(accept_rule, chk_err=False) == 0 or \
shellutil.run(drop_rule, chk_err=False) == 0:
if shellutil.run(drop_rule, chk_err=False) == 0:
logger.verbose("Firewall appears established")
return True
# Neither rule exists, append both rules
# Otherwise, append both rules
accept_rule = FIREWALL_ACCEPT.format("A", dst_ip, uid, FIREWALL_WAIT_IN_SECONDS)
drop_rule = FIREWALL_DROP.format("A", dst_ip, FIREWALL_WAIT_IN_SECONDS)
azurelinuxagent/common/protocol/wire.py
+6
View File
@@ -731,6 +731,12 @@ class WireClient(object):
self.host_plugin.container_id = goal_state.container_id
self.host_plugin.role_config_name = goal_state.role_config_name
return
except ProtocolError:
if retry < max_retry-1:
continue
raise
except WireProtocolResourceGone:
logger.info("Incarnation is out of date. Update goalstate.")
xml_text = self.fetch_config(uri, self.get_header())
azurelinuxagent/common/version.py
+1 -1
View File
@@ -113,7 +113,7 @@ def get_distro():
AGENT_NAME = "WALinuxAgent"
AGENT_LONG_NAME = "Azure Linux Agent"
AGENT_VERSION = '2.2.14.3'
AGENT_VERSION = '2.2.14.4'
AGENT_LONG_VERSION = "{0}-{1}".format(AGENT_NAME, AGENT_VERSION)
AGENT_DESCRIPTION = """
The Azure Linux Agent supports the provisioning and running of Linux
tests/common/osutil/test_default.py
+3 -24
View File
@@ -498,36 +498,17 @@ Match host 192.168.1.2\n\
uid = 42
wait = 30
mock_run.side_effect = [1, 1, 0, 0]
mock_run.side_effect = [1, 0, 0]
mock_output.return_value = (0, "Output")
self.assertTrue(util.enable_firewall(dst_ip=dst, uid=uid))
mock_run.assert_has_calls([
call(osutil.FIREWALL_ACCEPT.format("C", dst, uid, wait), chk_err=False),
call(osutil.FIREWALL_DROP.format("C", dst, wait), chk_err=False),
call(osutil.FIREWALL_ACCEPT.format("A", dst, uid, wait)),
call(osutil.FIREWALL_DROP.format("A", dst, wait))
])
mock_output.assert_called_with(osutil.FIREWALL_LIST)
@patch('os.getuid', return_value=42)
@patch('azurelinuxagent.common.utils.shellutil.run_get_output')
@patch('azurelinuxagent.common.utils.shellutil.run')
def test_enable_firewall_skips_if_accept_exists(self, mock_run, mock_output, mock_uid):
util = osutil.DefaultOSUtil()
dst = '1.2.3.4'
uid = 42
wait = 30
mock_run.side_effect = [0, 1, 0, 0]
self.assertTrue(util.enable_firewall(dst_ip=dst, uid=uid))
mock_run.assert_has_calls([
call(osutil.FIREWALL_ACCEPT.format("C", dst, uid, wait), chk_err=False)
])
mock_output.assert_not_called()
@patch('os.getuid', return_value=42)
@patch('azurelinuxagent.common.utils.shellutil.run_get_output')
@patch('azurelinuxagent.common.utils.shellutil.run')
@@ -538,11 +519,10 @@ Match host 192.168.1.2\n\
uid = 42
wait = 30
mock_run.side_effect = [1, 0, 0, 0]
mock_run.side_effect = [0, 0, 0]
self.assertTrue(util.enable_firewall(dst_ip=dst, uid=uid))
mock_run.assert_has_calls([
call(osutil.FIREWALL_ACCEPT.format("C", dst, uid, wait), chk_err=False),
call(osutil.FIREWALL_DROP.format("C", dst, wait), chk_err=False),
])
mock_output.assert_not_called()
@@ -557,11 +537,10 @@ Match host 192.168.1.2\n\
uid = 42
wait = 30
mock_run.side_effect = [1, 1, Exception]
mock_run.side_effect = [1, Exception]
self.assertFalse(util.enable_firewall(dst_ip=dst, uid=uid))
mock_run.assert_has_calls([
call(osutil.FIREWALL_ACCEPT.format("C", dst, uid, wait), chk_err=False),
call(osutil.FIREWALL_DROP.format("C", dst, wait), chk_err=False),
call(osutil.FIREWALL_ACCEPT.format("A", dst, uid, wait))
])